====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN077
_____________________________________________________________________

DATE                : 17/02/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running GitLab versions prior to 12.7.6,
                                    12.6.7, 12.5.10.

=====================================================================
https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/
_____________________________________________________________________

GitLab Critical Security Release: 12.7.6, 12.6.7, and 12.5.10
-
--------------------------------------------------------------------------------

Today we are releasing versions 12.7.6, 12.6.7, and 12.5.10 for GitLab
Community Edition (CE) and Enterprise Edition (EE).

These versions contain an important security fix, and we strongly
recommend that all GitLab installations be upgraded to one of these
versions immediately.

The vulnerability details will be made public on our issue tracker in
approximately 30 days.

Please read on for more information regarding this release.

Incorrect membership handling of group sharing feature:

Sharing a group with another group could grant project access to
unauthorized users. The issue is now mitigated in the latest release
and is assigned CVE-2020-8795.

Versions Affected:

Affects GitLab EE 12.5.0 and later.

Remediation:

We strongly recommend that all installations running an affected version
above are upgraded to the latest version as soon as possible.

Updating:

To update GitLab, see the Update page.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================